{
 "id": "AIR-2026-0306",
 "slug": "cve-2026-109289-open-webui-allows-deactivated-users-to-maint",
 "title": "CVE-2026-109289: Open WebUI allows deactivated users to maintain terminal access",
 "summary": "Open WebUI suffers from an improper authorization vulnerability that lets deactivated users continue executing terminal commands through open WebSockets. The platform's terminal proxy route failed to validate permissions on subsequent messages.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Open WebUI"
 ],
 "incident_date": "2026-10-12",
 "incident_date_precision": "day",
 "first_reported": "2026-10-12",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109289",
   "publisher": "NVD",
   "title": "CVE-2026-109289: Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerability that allows deactivated users to keep…",
   "published_at": "2026-10-12"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-109289",
  "authorization-bypass",
  "open-webui"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T06:33:31.967Z"
}